The web servers are serving content via HTTP and in front of them, a dedicated Cisco Ace load balancer is in charge of (1) load balancing across servers, (2) encrypt the content between the load balancer and the browser via HTTPS.

HTTPS is used to access the website from the outside of the network, HTTP is used to access the site internally and we are forced to have the SSL encryption set up at the RP/LB level.

For this reason, the only option that works is to generate relative URL's in all cases.

I have hacked IORepositoryResolver->resolve() to remove the call to $this->getBaseUrl(). Everything works correctly for now, but since I don't know the original reason. I cannot test efficiently why and when this was required. Something with LiipImagine?

An alternative and less intrusive solution would be decorate the "asset()" twig function so that it remove the scheme/host/port if it matches a defined one. But it seems there is no feature for decorating a function.